We believe he's given others control of his Github and other account logins. It does seem like he's taking precautions with a VPN.
How would you go about exposing this? Ideally in a brilliant and clever way.
At some point, getting your manager and/or their manager involved will be inevitable, and this is exactly the sort of problem that managers and HR exist to deal with. (assuming you're not their manager yourself).
> How would you go about exposing this? Ideally in a brilliant and clever way.
I wouldn't. If it causes problems, let your employer address them.
Ask for detailed estimates and breakdown on a problem they never heard before, and insist on an initial approach to the solutoin, then verify with what is delivered.
When you do either of these, make sure there are experienced technical people asking questions. Anyone who is technical will not mind explaining code or solutions on the spot. At the very least there should be open conversations on approach, and usually you won't be able to hold that conversation if you are not doing the job.
- Consider how you'd like to be treated; like for real. What if it was you?
- Burning bridges over something like this isn't worth it. Burning bridges over anything, is almost always a bad idea. Seek to mend.